EP4095079B1 - Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine - Google Patents

Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine

Info

Publication number
EP4095079B1
EP4095079B1 EP21176745.4A EP21176745A EP4095079B1 EP 4095079 B1 EP4095079 B1 EP 4095079B1 EP 21176745 A EP21176745 A EP 21176745A EP 4095079 B1 EP4095079 B1 EP 4095079B1
Authority
EP
European Patent Office
Prior art keywords
elevator
computing device
controller
remote computing
safety
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP21176745.4A
Other languages
English (en)
French (fr)
Other versions
EP4095079A1 (de
Inventor
Peter Herkel
Dirk H. Tegtmeier
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Otis Elevator Co
Original Assignee
Otis Elevator Co
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Otis Elevator Co filed Critical Otis Elevator Co
Priority to EP21176745.4A priority Critical patent/EP4095079B1/de
Priority to US17/529,563 priority patent/US20220380173A1/en
Priority to CN202111367923.7A priority patent/CN115402902B/zh
Publication of EP4095079A1 publication Critical patent/EP4095079A1/de
Application granted granted Critical
Publication of EP4095079B1 publication Critical patent/EP4095079B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
    • B66B1/3415—Control system configuration and the data transmission or communication within the control system
    • B66B1/3446—Data transmission or communication within the control system
    • B66B1/3461—Data transmission or communication within the control system between the elevator control system and remote or mobile stations
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0006—Monitoring devices or performance analysers
    • B66B5/0018—Devices monitoring the operating condition of the elevator system
    • B66B5/0025—Devices monitoring the operating condition of the elevator system for maintenance or repair
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/02—Control systems without regulation, i.e. without retroactive action
    • B66B1/06—Control systems without regulation, i.e. without retroactive action electric
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
    • B66B1/3415—Control system configuration and the data transmission or communication within the control system
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B1/00—Control systems of elevators in general
    • B66B1/34—Details, e.g. call counting devices, data transmission from car to control system, devices giving information to the control system
    • B66B1/3415—Control system configuration and the data transmission or communication within the control system
    • B66B1/3446—Data transmission or communication within the control system
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0006—Monitoring devices or performance analysers
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/0006—Monitoring devices or performance analysers
    • B66B5/0018—Devices monitoring the operating condition of the elevator system
    • B66B5/0031—Devices monitoring the operating condition of the elevator system for safety reasons
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B66—HOISTING; LIFTING; HAULING
    • B66B—ELEVATORS; ESCALATORS OR MOVING WALKWAYS
    • B66B5/00—Applications of checking, fault-correcting, or safety devices in elevators
    • B66B5/02—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions
    • B66B5/027—Applications of checking, fault-correcting, or safety devices in elevators responsive to abnormal operating conditions to permit passengers to leave an elevator car in case of failure, e.g. moving the car to a reference floor or unlocking the door

Definitions

  • This disclosure relates to an elevator system and a method of restoring operation of an elevator car in an elevator system.
  • each switch, or safety contact, in the safety chain corresponds to a separate component of the elevator system, e.g. door sensors detecting whether a door lock has engaged.
  • the safety chain is configured such that the activation of a single safety contact, e.g. the opening of a single switch in the safety chain, due to a failure of any one of the sensed components, prevents operation of the elevator system.
  • US 2019/0210837 A1 discloses a rescue operation in an elevator system.
  • US 2006/0260880 A1 discloses a remote supervisory control system for an elevating machine.
  • an elevator system as claimed in claim 1.
  • overriding of the safety controller refers to overriding the automatic action of the safety controller which normally prevents movement of the elevator car (e.g. disconnection of the drive power supply) such that once again movement of the elevator car is permitted.
  • the remote computing device acts in any suitable way to reverse the indication of an unsafe condition from one of the safety contacts. This may, for example, involve an override command from the remote computing device to the safety controller.
  • the remote computing device can override the safety controller by bridging the safety contacts that indicated an unsafe condition, e.g. using software of the safety controller.
  • Such an override is required in order to re-enable movement of the elevator car e.g. following an emergency stop due to the opening of a safety contact. It is particularly important that movement of the elevator car is re-enabled where passengers are trapped within the elevator car following an emergency stop.
  • a maintenance person can therefore recover trapped passengers without having to make a physical visit to the elevator system. This reduces the time in which trapped passengers can be recovered, and also improves efficiency and convenience of carrying out a recovery operation for the elevator system.
  • the safety controller is separate from the elevator controller.
  • authentication of the remote computing device by the safety controller does not grant authenticated access to the elevator controller, and likewise a separate authentication to the elevator controller does not grant authenticated access to the safety controller or permission to override the safety controller.
  • authenticating directly with the safety controller provides an increased level of cyber security, since a different authentication signature might be used for this authentication, separate to any authentication information used to authenticate to the elevator controller.
  • the authentication information required to access the safety controller may be provided to fewer maintenance personnel, e.g. a subset of maintenance personnel, compared to those provided with the authentication information required to access the elevator controller, thus improving security. For example, only certain users such as remote experts might be provided with the first authentication information needed to authenticate the remote computing device with the safety controller.
  • the safety controller and the elevator controller may each have independent connections to a drive system for the elevator car.
  • the elevator controller is connected to a drive system in order to control operation of the elevator car and the safety controller is independently connected to the drive system in order to prevent movement of the elevator car.
  • the drive system may include a drive motor and a motor brake.
  • the elevator controller may be configured to control operation of the drive motor (to move the car) and the motor brake (to stop the car), e.g. during normal operation of the elevator system.
  • the safety controller may be configured to interrupt a power supply to the drive system so that the drive motor is prevented from operating and the motor brake is automatically applied, e.g. in response to an unsafe condition of the elevator system.
  • the safety controller operates independently from the operation of the elevator controller to prevent movement of the elevator car (e.g. in an emergency stop situation), although the safety controller and the elevator controller may exchange information.
  • the safety controller may provide the individual status information to the elevator controller.
  • the safety controller includes its own logic, by which the individual status of each safety contact is monitored and checked.
  • the plurality of safety contacts monitor the elevator system and are connected to the safety controller, e.g. over a bus.
  • the safety controller may be part of a safety system, the safety system also comprising bus nodes, which are connected to a bus, wherein the bus is connected to the safety controller, and the bus nodes are connected to the safety contacts.
  • the bus may be a Controller Area Network (CAN) bus.
  • CAN Controller Area Network
  • any other suitable communication means may be employed to connect the safety controller to the safety contacts.
  • the safety controller may include a microprocessor, which may run software. The microprocessor may poll the bus nodes, e.g. at regular intervals, to obtain the individual status information of the safety contacts.
  • any of the plurality of safety contacts may be a physical set of contacts or switch, for example a limit switch arranged in the hoistway, or alternatively a virtual set of contacts or switch embedded in software within the safety controller.
  • the safety controller may comprise suitable software which monitors the speed of the elevator car or the current draw of a drive motor which operates to drive the elevator car.
  • Such virtual safety contacts may be configured to indicate an unsafe status, for example, upon detecting that the elevator car is moving too fast, or when the drive motor is drawing too much current.
  • the safety controller is configured to receive the individual status of each of the plurality of safety contacts.
  • receive it is meant that the safety controller might receive information which already indicates the status information of each safety contact individually, e.g. information received from a node, or might receive information from which said status information is then derived by the safety controller itself.
  • at least one subset of the plurality of safety contacts are wired in parallel to each other, then connected to a bus node, such that the bus node knows, for each received status information signal, which safety contact sent that status information signal.
  • the safety controller is configured to be connected to a remote computing device.
  • a remote computing device is one which is located remotely relative to the elevator system, i.e. as opposed to being located locally at the elevator system.
  • Such a remote computing device therefore does not require, and preferably does not have, a physical connection to the elevator system, but rather can be located far from the elevator system, e.g. could be located in a service centre far away.
  • the safety controller is configured to receive an override command from the remote computing device before enabling movement of the elevator car.
  • the method further comprises the remote computing device sending an override command to the safety controller, and the safety controller receiving the override command before enabling movement of the elevator car.
  • a separate override command after successful authentication, ensures that the safety controller's prevention of elevator car movement is only carried out if specifically instructed by a user of the remote computing device, e.g. following an assessment of the status of the elevator system. This therefore allows a user of the remote computing device to assess the elevator system and then make an informed and reasoned decision as to whether to issue an override command. Such a decision may be based, for example, on information received at the remote computing device which relates to the elevator system, including e.g. individual status information of each safety contact, information indicating the position of the elevator car, or whether there are passengers inside the elevator car.
  • the method comprises the remote computing device sending an override command to the safety controller when the individual status information is received from landing door safety contacts.
  • the elevator system further comprises a position determination system connected to the elevator controller and/or safety controller.
  • the position determination system may be any position reference system that is capable of outputting a position of the elevator car within the hoistway.
  • the position determination system may comprise an encoder associated with the drive system, which is capable of outputting a position of the elevator car within the hoistway based on measurements related to the movement of the drive motor.
  • the position determination system is an absolute position determination system, i.e. which accurately determines the absolute position of the elevator car relative to a hoistway in which the elevator car travels.
  • the position determination system advantageously collects (e.g. absolute) position information about the elevator car which can then be made available to a maintenance person, e.g. by means of the remote computing device. This position information may be used by the remote maintenance person to make a better informed decision about overriding the safety controller.
  • control commands may be received by the safety controller, in order to assist with a rescue operation, thus requiring only a single authentication for the remote computing device.
  • the position determination system provides position information to the safety controller.
  • the safety controller may be configured to provide the position information to the remote computing device, if the remote computing device is authenticated by the safety controller.
  • the method further comprises the safety controller sending position information to the remote computing device once authenticated by the safety controller. This allows a user of the remote computing device to receive position information directly from the safety controller, which can then be used to determine whether it is safe to override the action of the safety controller to prevent movement of the elevator car.
  • the safety controller may also provide the status of each individual safety contact to the remote computing device, and/or a derived safety status of the elevator system (e.g. operation mode, or blockage conditions etc.), and/or other safety-related information not based on the safety contacts, e.g. relating to brake behaviour.
  • a derived safety status of the elevator system e.g. operation mode, or blockage conditions etc.
  • other safety-related information not based on the safety contacts, e.g. relating to brake behaviour.
  • the safety controller is configured to receive an action command from the remote computing device and to control operation of the elevator car to carry out an action in response to the action command following authentication.
  • the method further comprises the remote computing device sending an action command to the safety controller and the safety controller controlling operation of the elevator car to carry out an action in response to the action command following authentication.
  • An action command may be, for example, a command to move the elevator car up or down the hoistway, or a command to open the doors of the elevator car. This further allows the user to directly control operation of the elevator car, e.g. to drive the car to a landing, and/or to open the elevator car doors, by directly communicating with the safety controller once the remote computing device is authenticated.
  • the remote computing device may further communicate with the elevator controller in order to restore operation of the elevator car.
  • the elevator controller is configured to connect to the remote computing device, to receive second authentication information from the remote computing device, and to authenticate the remote computing device if the second authentication information meets an authentication condition.
  • This second authentication is separate from the first authentication by the safety controller, and may require separate security credentials.
  • This second authentication information may be the same authentication information as is routinely used by maintenance personnel to obtain elevator system status information from the elevator controller, e.g. not only when an unsafe condition is indicated, but also during routine maintenance.
  • This separate authenticated communication may allow the remote computing device to obtain useful information which is known to the elevator controller, and/or to transmit control signals to the elevator controller in order to control operation of the elevator car, without further involvement by the safety controller.
  • the method further comprises: the remote computing device sending second authentication information to the elevator controller; the elevator controller checking whether the second authentication information meets an authentication condition; and if the second authentication information meets the authentication condition, authenticating the remote computing device.
  • the method may comprise the elevator controller sending position information to the remote computing device following authentication.
  • the safety controller may be configured to provide the individual status information of each of the plurality of safety contacts to the elevator controller.
  • the elevator controller may also provide the status of each individual safety contact to the remote computing device.
  • the elevator controller is configured to receive the individual status information received from the safety contact that has indicated an unsafe condition and to send the individual status information to the remote computing device following authentication.
  • the method may therefore comprise the safety controller sending to the elevator controller the individual status information received from the safety contact that has indicated an unsafe condition, and the elevator controller sending the individual status information to the remote computing device following authentication.
  • the elevator controller is configured to receive an action command from the remote computing device and to control operation of the elevator car to carry out an action in response to the action command following authentication.
  • the method further comprises the remote computing device sending an action command to the elevator controller, and the elevator controller controlling operation of the elevator car to carry out an action in response to the action command following authentication.
  • the user of the remote computing device can control operation of the elevator car (which is re-enabled following first authentication of the remote computing device by the safety controller and issuing of an override command), for example to drive the elevator car to a landing and/or open the elevator car doors.
  • the present disclosure extends to a remote control system including the elevator system disclosed herein connected to the remote computing device referred to above.
  • the remote control system comprises a remote computing device, i.e. a device located remotely from the elevator system, on which is stored first authentication information.
  • the remote computing device may be configured to connect to a (wireless) network.
  • the remote computing device may be configured to authenticate with the safety controller using the first authentication information.
  • the remote computing device may also store second authentication information.
  • the remote computing device may be configured to authenticate with the elevator controller using the second authentication information.
  • the first authentication information and/or the second authentication information may be a certificate.
  • the first authentication information and/or the second authentication is asymmetrically encrypted (i.e. encryption which uses a public key together with a corresponding private key).
  • This is a reliable and safe authentication method.
  • the remote computing device may be configured to asymmetrically encrypt a first set of credentials to provide the first authentication information.
  • the remote computing device may be configured to encrypt the first set of credentials with a first public key or a first private key.
  • the remote computing device may be configured to encrypt a second set of credentials with a second public key or a second private key to provide the second authentication information.
  • the first set of credentials and the second set of credentials may be the same or different.
  • the safety controller stores a first private key, and is configured to decrypt the encrypted first authentication information using the first private key.
  • the safety controller stores a first public key, and is configured to decrypt the encrypted first authentication information using the first public key.
  • the first private key corresponds to the first public key, in the manner known in the field of asymmetric encryption.
  • the (first) authentication condition (for authenticating the remote computing device to the safety controller) may be the successful decryption of the encrypted first authentication information using the first private or public key.
  • the first authentication information and/or the second authentication information is symmetrically encrypted (i.e. encryption which uses a private key, known to both parties, for both encryption and decryption).
  • the private key may be generated during an initial authentication round and be stored only for a particular communication session.
  • the elevator controller stores a second private key, and is configured to decrypt the encrypted second authentication information using the second private key.
  • the elevator controller stores a second public key, and is configured to decrypt the encrypted second authentication information using the second public key.
  • the second private key corresponds to the second public key, in the manner known in the field of asymmetric encryption.
  • the (second) authentication condition by which the remote computing device is authenticated by the elevator controller, may be the successful decryption of the encrypted second authentication information using the second private or public key.
  • the first authentication information and/or the second authentication information may be generated by a (trusted) certificate authority.
  • the remote computing device may send a first request and/or a second request containing the first public key and/or the second public key and the first and/or second set of credentials, respectively, to the certificate authority.
  • the certificate authority may verify the information in the request and generate the first authentication information and/or the second authentication information by encrypting the first and/or second request with a certificate authority private key. This first and/or second authentication information may then be sent to the remote computing device, and stored on the remote computing device.
  • the safety controller may confirm that the certificate authority has verified the first authentication information and/or the second authentication information by decrypting the information using a certificate authority public key (i.e. a key corresponding to the certificate authority's private key).
  • the method further comprises the remote computing device encrypting a first set of credentials to provide the first authentication information using a (first) public key or a (first) private key.
  • the method further comprises the safety controller decrypting the first authentication information using a (first) private key, stored on the safety controller.
  • the method further comprises the remote computing device encrypting a second set of credentials to provide the second authentication information using a second public key or a second private key.
  • the method further comprises the elevator controller decrypting the second authentication information using a second private key, stored on the elevator controller.
  • the safety controller may be configured to connect to the remote computing device over a (wired or wireless) communications network.
  • the elevator controller may be configured to connect to the remote computing device over a (wired or wireless) communications network.
  • the remote control system further comprises a wireless network, preferably a long-range wireless network such as a cloud-based network (e.g. the Internet).
  • the method further comprises the remote computing device and/or the safety controller, and/or the elevator controller connecting to a (wireless) communications network.
  • the method may further comprise the remote computing device sending the first authentication information to the safety controller over the (wireless) communications network.
  • the method may further comprise the remote computing device sending the second authentication information to the elevator controller over the (wireless) communications network.
  • an elevator system 20 comprises an elevator car 22 that runs in a hoistway 34 between various floors of a building.
  • the elevator car 22 is suspended in the hoistway 34 by a tension member 26 (e.g. one or more ropes or belts).
  • the other end of the tension member 26 is connected to a counterweight 24.
  • the elevator car 22 and the counterweight 24 are moving components in the elevator system 20.
  • the elevator system may be ropeless.
  • the elevator car 22 travels up and down in the hoistway 34 to transport passengers and/or cargo between floors of the building.
  • the elevator car 22 is driven by a drive system 30 comprising a drive motor 32 and a motor brake 36.
  • the tension member 26 passes over a drive sheave (not shown) that is driven to rotate by the drive motor 32 and braked by the motor brake 36.
  • Normal operation of the drive system 30 is controlled by an elevator controller 40.
  • the elevator system 20 also comprises an absolute position measurement system 50 configured to determine the absolute position and velocity of the elevator car 22 in the hoistway 34.
  • the absolute position measurement system 50 is configured to output a measurement of the absolute position and velocity of the elevator car 22 to the elevator controller 40.
  • the absolute position measurement system 50 may be connected to a safety controller 52 (described in more detail below), as well as or instead of its connection to the elevator controller 40.
  • the absolute position measurement system 50 can include a coded tape (not shown) extending at least part of the way along the hoistway 34and two sensors (not shown) mounted on the elevator car 22 and arranged to read the coded tape to determine the absolute position and velocity of the elevator car 22 in the hoistway 34.
  • the elevator system 20 also comprises a safety system 53, including a safety controller 52 connected to a safety bus 54.
  • a safety system 53 including a safety controller 52 connected to a safety bus 54.
  • the absolute position measurement system 50 may also (or alternatively) be connected to a safety controller 52 over the safety bus 54, and may also (or alternatively) supply the position and velocity information to the safety controller 52.
  • the safety controller 52 may be a node as defined in the relevant Programmable Electronic System in Safety Related Applications for Lifts (PESSRAL) standard(s).
  • the safety controller 52 communicates over the safety bus 54 with a plurality of bus nodes 42a-d, 44, 46, 48a-b.
  • the safety bus 54 may be a CAN bus, and is represented in Figures 1 and 2 with a dashed line.
  • the bus nodes 42a-d, 44, 46, 48a-b are each associated with one of a plurality of safety contacts located throughout the elevator system 20.
  • There is a pit switch node 44 which is associated with a safety contact in the pit of the elevator system 20. This safety contact may be opened by a maintenance person when they are working in the pit.
  • There is an overspeed node 46 associated with an overspeed switch or safety contact which detects an overspeed condition of the elevator car, and opens if an overspeed is detected.
  • the overspeed node 46 is connected to the absolute position measurement system 50.
  • the safety system 53 is shown in greater detail in Figure 2 , together with associated components. It can be seen that each of the nodes 42a-d, 44, 46, 48a-b is connected to at least one of the safety contacts 41a-41h, as described above.
  • the safety system 53 also includes an actuator node 56, connected to the safety bus 54. If required, the actuator node 56 can interrupt the supply of power to the drive system 30 to execute an emergency stop, as described below. It will be understood that the actuator node 56 in the safety system 53 is configured to interrupt operation of the drive system 30 (e.g. upon detection of an unsafe condition) independently of the elevator controller 40 being configured to control the drive system 30 during normal operating conditions. Actuator node 56 simply allows or prevents movement of the elevator car 22, but cannot be used to drive the elevator car 22 to a floor. It is the elevator controller 40 which issues a run command to the drive system 30.
  • the safety bus 54 also connects the safety controller 52 to a wireless communications gateway 60, by means of which the safety controller 52 can wirelessly connect with a server 62 and further with a remote computing device 64 connected to said server 62, as described below.
  • the safety bus 54 is also connected to the elevator controller 40, such that the elevator controller 40 receives individual status information from the safety system 53, indicating the status of each of the safety contacts 41a-41g, i.e. whether each safety contact is open or closed.
  • the safety controller 52 monitors and evaluates the individual status of each safety contact, but this information is also provided to the elevator controller 40 to facilitate maintenance work, e.g. by displaying the status of the individual safety contacts, or the overall safety chain, on devices in the elevator system.
  • an emergency stop of the elevator car 22 may be triggered, based on information obtained from the various nodes connected to the safety bus 54. For instance, if a hoistway door is opened (as detected by nodes 42a-d), if a maintenance worker is present in the pit of the hoistway (as detected by node 44) or, the elevator car 22 travels too quickly (as detected by overspeed node 46) an emergency stop may be executed, e.g. by interrupting the supply of power to the drive system 30 using the actuator node 56. The loss of power triggers the brake 36 to engage and stops the motor 32 (i.e. removes any drive torque applied to the drive sheave). This brings the elevator car 22 (and the counterweight 24) quickly to a halt.
  • the elevator system Once the safety controller 52 has been triggered in this way, it is known for the elevator system to be configured such that the safety system 53 cannot then be overridden, and therefore movement of the elevator car restored, until a maintenance person attends the elevator system 20, in person, inspects the elevator system 20, and manually overrides the safety controller 52. In some cases passengers are inside the car when the emergency stop is carried out, and will therefore become trapped if the car is stopped between landings. Override of the safety controller 52, in order to allow the car to be moved to a landing, is required in order to rescue such trapped passengers.
  • the method is carried out between a passenger or passengers 200 (who are trapped in an elevator car following an emergency stop) and a maintenance person or mechanic 202, who attends the elevator system physically in person to carry out a manual override of a safety controller 252.
  • the method is carried out by communications between these two parties, by means of an elevator controller 240, the safety controller 252, and an elevator service 204 (where the server 62 is hosted for communication with the elevator controller 240 and the safety controller 252).
  • the passenger is using the elevator car during normal operation.
  • a signal at one of the bus nodes causes the safety controller 252 to provide a signal to the elevator controller 240, at step 212, which prevents movement of the elevator car.
  • the mechanic 202 visits the elevator system. Once present locally on site, the mechanic 202 requests elevator status details from the elevator controller 240 at step 222. In response, at step 224, the elevator controller 240 responds by providing the status details of the elevator system.
  • the mechanic 202 informs the passengers 200 of the rescue operation via a speaker in the car, by means of the elevator controller.
  • the mechanic 202 manually bypasses the safety contact which has triggered the emergency stop, where the mechanic has determined that it is safe to do so, and, at step 230, manually activates an emergency electrical operation of the elevator car.
  • the mechanic is then able to manually run the car in an up or down direction, at step 232, using manual controls of the elevator controller 240, until the car arrives at a landing of the elevator system, at step 234.
  • the mechanic 202 terminates the manual run command, at step 236, and manually opens the landing doors of the elevator car, at step 238.
  • the mechanic 202 then removes the bypass of the safety contact, at step 244. This process is time consuming since it requires a mechanic to physically attend the elevator system, and also requires a large amount of manual intervention by the mechanic.
  • the method is carried out between a passenger or passengers 300 (who are trapped in the elevator car 22 following an emergency stop) and a maintenance person or mechanic 302, who is using a remote computing device 64 (shown in Figure 2 ).
  • the method is carried out by communications between these two parties, by means of the elevator controller 40, the safety controller 52, and an elevator service 304.
  • step 310 the passenger is using the elevator car during normal operation. Then a signal at one of the bus nodes causes the safety controller 52 to detect an unsafe condition and provide a signal to the actuator node 56 to interrupt the supply of power to the drive system 30, which prevents movement of the elevator car 22. Then, at step 312, the safety controller 52 will also notify the elevator controller 40 of the new status of the elevator system. The prevention of movement of the elevator car 22 causes the elevator car 22 to undergo an emergency stop. This results, at step 314, in passengers becoming trapped. Passengers 300 then sound an alarm within the elevator car 22, which causes an alarm signal to be sent to the elevator service 304 at step 316. This elevator service 304 then signals a mechanic, 302 at step 318.
  • the mechanic 302 instead remotely accesses the elevator system, more specifically the safety controller 52 itself, as described below.
  • the remote computing device 64 first (or prior to the beginning of this method) establishes a data connection with an Otis server 62, as represented by the dashed line between the remote computing device 64 and the Otis server 62 in Figure 2 .
  • the Otis server 62 can communicate wirelessly, e.g. by means of respective antennae, with the gateway 60 which is connected to the safety bus 54 and therefore to the safety controller 52 and the elevator controller 40.
  • the remote computing device 64 is able to communicate (e.g. exchange data and/or commands with) the safety controller 52, and the elevator controller 40.
  • the mechanic 302 transmits a request to the elevator controller 40, via the wireless data connection to the gateway 60, requesting information about the elevator system 40, for example including the position of the elevator car and/or the status of each individual safety contact connected to the safety controller 52.
  • the information may also include a variety of other information which is useful for elevator maintenance, for example a derived safety status of the elevator system (e.g. operation mode, or blockage conditions etc.), and other safety-related information not based on the safety contacts, e.g. relating to brake behaviour.
  • the elevator controller 40 In order to ensure that such status information is not transmitted to a third party who is not entitled to access the information, e.g. a hacker, the elevator controller 40 requires the remote computing device 64 to undergo, and successfully pass, an authentication process, so that the information is only transmitted to authorised parties. To start this process, at step 323, the elevator controller 40 transmits a signal back to the remote computing device 64 indicating to the mechanic 302 that authorisation is required.
  • the mechanic 302 responds by providing authentication information to the elevator controller, in a process which is described in greater detail with respect to Figure 5 .
  • the elevator controller 40 checks this information, as described below, and, if authentication is successful, sends a response to the remote computing device 64 at step 324, indicating that authentication of the remote computing device 64 has been granted, and providing the requested status information to the mechanic 302.
  • the mechanic 302 is then able to make an informed decision as to whether override of the safety controller 52 is required, e.g. if the elevator car is located between landings and so must be moved to a landing in order to allow passengers to exit, and also whether overriding of the safety controller 52 is a safe decision. If the mechanic 302 decides that override of the safety controller 52 is required, the method then proceeds as described below.
  • the mechanic 302 informs the passengers 300 of the rescue operation via a speaker in the car, by means of the elevator controller 40.
  • the safety controller 52 In order to move the elevator car, the safety controller 52 must be overridden. Previously, a bypass was carried out by a maintenance person locally present at the elevator system, as described above, and therefore conventional security, e.g. security guards present at building entrances, prevent access of unauthorised parties. In the present method, the safety system 52 is accessible remotely by means of a wireless connection. Therefore, in order to ensure that only an authorised person is able to override the safety controller 40, authentication of the remote computing device 64 used by the mechanic 302, to the safety controller 52 is required. The remote computing device 64 must authenticate to the safety controller 52, separately to the authentication to the elevator controller 40 which is described above.
  • a first step 350 the mechanic 302 sends an override command to the safety controller 52, instructing the safety controller 52 to re-enable movement of the elevator car, i.e. to override the safety contact which was opened to trigger the emergency stop.
  • the safety controller 52 then sends a response to the remote computing device 64, at step 352, indicating the mechanic 302 that authorisation is required.
  • the mechanic 302 responds by providing authentication information to the safety controller 52, in a process which is described in greater detail with respect to Figure 5 .
  • the safety controller 52 checks this information, as described below, and, if authentication is successful, sends a response to the remote computing device 64 at step 356, indicating that authentication of the remote computing device 64 has been granted.
  • the safety controller 52 then executes the override command, so that movement of the elevator car 22 is once again enabled, despite a safety contact being open, and sends a signal at step 358 to the remote computing device 64, indicating that the override command has been executed.
  • Movement of the elevator car 22 is therefore once again possible.
  • the elevator car may automatically move itself to the nearest landing, without specific instruction from the mechanic 302.
  • the mechanic may send an explicit run command to the elevator controller 40, instructing the elevator car to begin travelling up or down the hoistway.
  • the elevator controller 40 transmits a signal to the remote computing device 64, indicating that the run command is in execution, i.e. that the elevator car is being moved, and then transmits a further signal at step 334, indicating that the elevator car has arrived at a landing.
  • the mechanic 302 then issues a door open command from the remote computing device 64 to the elevator controller 40, at step 338 in response to which the elevator car doors are opened, and as a result the passengers are rescued, at step 342.
  • the safety controller 52 sends a signal to the remote computing device 64, indicating that the override command has been terminated, so that operation of the elevator car is once again prevented, until the safety contact(s) have been "closed” to restore a normal operating condition of the elevator system. Then, at step 366, the authorisation of the remote computing device 64 to the safety controller 52 is terminated. In future, if the same mechanic 302 using the same remote computing device 64 wishes to override the safety controller 52, a new authentication to the safety controller 52 will therefore be required.
  • FIG. 5 shows an authentication process between a remote computing device 64 and, respectively, a safety controller 52, and an elevator controller 40.
  • the remote computing device 64 stores a first certificate 500, and a first public key 502.
  • This first public key 502 may not be permanently stored on the remote computing device 64, but may be retrieved from elsewhere when required.
  • a trusted certificate authority is used to generate the certificate. To do so, firstly the remote computing device 64 sends a request, containing the first public key 502 and remote computing device credentials (e.g. credentials encrypted with the first public key 502), to a certificate authority. The certificate authority verifies the information in the request and "digitally signs" the certificate with a certificate authority private key (which the certificate authority guarantees cannot be hacked). This certificate 500 is then sent to the remote computing device 64, where it is stored.
  • the remote computing device 64 sends a request, containing the first public key 502 and remote computing device credentials (e.g. credentials encrypted with the first public key 502), to a certificate authority.
  • the certificate authority verifies the information in the request and "digitally signs" the certificate with a certificate authority private key (which the certificate authority guarantees cannot be hacked).
  • This certificate 500 is then sent to the remote computing device 64, where it is stored.
  • the certificate 500 is sent to the safety controller 52.
  • the safety controller 52 can then confirm the certificate authority's digital signature using the certificate authority's public key, and can also confirm that the remote computing device 64 is in possession of the first public key, using a private key 504, also referred to as a factory key, stored on the safety controller 52 - specifically on a smart card chip 508, e.g. by decrypting the credentials.
  • the validity of the decrypted certificate 500a is then checked, e.g. it is checked whether the certificate is signed by a trusted certificate authority.
  • the remote computing device 64 is considered to be verified.
  • the remote computing device 64 stores a second certificate 600, generated in the same manner as described above using a second public key 602 stored on the remote computing device 64.
  • the safety controller 52 can then confirm the certificate authority's digital signature using the certificate authority's public key, and can also confirm that the remote computing device 64 is in possession of the second public key 602 using a second private key 604, also referred to as a factory key, stored on the safety controller 52 - specifically on a smart card chip 608.
  • the validity of the decrypted certificate 600a is then checked, e.g. it is checked whether the certificate is signed by a trusted certificate authority.
  • the certificate authority (and therefore the certificate authority private and public keys) can be the same for both the first and second certificates 500, 600, or different certificate authorities could be used to generate each.

Landscapes

  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Elevator Control (AREA)

Claims (15)

  1. Aufzugssystem (20), umfassend:
    eine Aufzugskabine (22);
    eine Aufzugsteuerung (40), die konfiguriert ist, um den Betrieb der Aufzugskabine (22) zu steuern; und
    dadurch gekennzeichnet, dass es eine Sicherheitssteuerung (52) umfasst, die von der Aufzugsteuerung (40) getrennt ist, und eine Vielzahl von Sicherheitskontakten, die mit der Sicherheitssteuerung (52) verbunden sind, wobei die Vielzahl von Sicherheitskontakten das Aufzugssystem (20) überwacht,
    wobei die Sicherheitssteuerung (52) dazu konfiguriert ist, individuelle Statusinformationen von jedem der Vielzahl von Sicherheitskontakten zu empfangen und eine Bewegung der Aufzugskabine (22) zu verhindern, wenn die von einem der Vielzahl von Sicherheitskontakten empfangenen individuellen Statusinformationen einen unsicheren Zustand des Aufzugssystems (20) anzeigen;
    wobei die Sicherheitssteuerung (52) dazu konfiguriert ist, eine Verbindung zu einer entfernten Rechenvorrichtung (64) herzustellen, erste Authentifizierungsinformationen (500) von der entfernten Rechenvorrichtung (64) zu empfangen und die entfernte Rechenvorrichtung (64) zu authentifizieren, wenn die ersten Authentifizierungsinformationen (500) eine Authentifizierungsbedingung erfüllen; und
    wenn die entfernte Rechenvorrichtung (64) authentifiziert ist, der entfernten Rechenvorrichtung (64) zu gestatten, die Sicherheitssteuerung (52) zu umgehen, um die Bewegung der Aufzugskabine (22) zu ermöglichen.
  2. Aufzugssystem (20) nach Anspruch 1, wobei die Sicherheitssteuerung (52) so konfiguriert ist, dass sie einen Umgehungsbefehl von der entfernten Rechenvorrichtung (64) empfängt, bevor sie die Bewegung der Aufzugskabine (22) freigibt.
  3. Aufzugssystem (20) nach Anspruch 1 oder 2, wobei die Aufzugsteuerung (40) dazu konfiguriert ist, eine Verbindung zu der entfernten Rechenvorrichtung (64) herzustellen, um zweite Authentifizierungsinformationen (600) von der entfernten Rechenvorrichtung (64) zu empfangen und die entfernten Rechenvorrichtung (64) zu authentifizieren, wenn die zweiten Authentifizierungsinformationen (600) eine Authentifizierungsbedingung erfüllen.
  4. Aufzugssystem nach Anspruch 3, wobei die Aufzugsteuerung (40) dazu konfiguriert ist, einen Aktionsbefehl von der entfernten Rechenvorrichtung (64) zu empfangen und den Betrieb der Aufzugskabine (22) zu steuern, um als Reaktion auf den Aktionsbefehl nach der Authentifizierung eine Aktion auszuführen.
  5. Aufzugssystem nach Anspruch 3 oder 4, wobei die Aufzugsteuerung (40) dazu konfiguriert ist, die individuellen Statusinformationen zu empfangen, die sie von dem Sicherheitskontakt erhält, der einen unsicheren Zustand angezeigt hat, und die individuellen Statusinformationen nach der Authentifizierung an die entfernten Rechenvorrichtung (64) zu senden.
  6. Aufzugssystem nach einem der vorhergehenden Ansprüche, wobei das Aufzugssystem ferner ein Positionsbestimmungssystem (50) umfasst, das dazu eingerichtet ist, Positionsinformationen zur Aufzugskabine an die Aufzugsteuerung (40) und/oder die Sicherheitssteuerung (52) zu liefern, wobei die Aufzugsteuerung (40) und/oder die Sicherheitssteuerung (52) dazu konfiguriert ist, die Positionsinformationen zur Aufzugskabine nach der Authentifizierung an die entfernte Rechenvorrichtung (64) zu senden.
  7. Fernsteuerungssystem, das das Aufzugssystem nach einem der vorhergehenden Ansprüche umfasst und ferner umfasst:
    eine entfernte Rechenvorrichtung (64), auf der erste Authentifizierungsinformationen (500) gespeichert sind, wobei sich die entfernte Rechenvorrichtung entfernt vom Aufzugssystem (20) befindet und so konfiguriert ist, dass sie über ein Kommunikationsnetzwerk eine Verbindung zum Aufzugssystem (20) herstellt.
  8. Fernsteuerungssystem nach Anspruch 7, wobei zweite Authentifizierungsinformationen (600) auf der entfernten Rechenvorrichtung (64) gespeichert sind,
    wobei die entfernte Rechenvorrichtung (64) so konfiguriert ist, dass sie von der Aufzugsteuerung (40) unter Verwendung der zweiten Authentifizierungsinformationen (600) authentifiziert wird.
  9. Fernsteuerungssystem nach Anspruch 7 oder 8, wobei die entfernte Rechenvorrichtung (64) so konfiguriert ist, dass die ersten Authentifizierungsinformationen (500) asymmetrisch verschlüsselt werden.
  10. Verfahren zur Wiederherstellung des Betriebs einer Aufzugskabine (22) in einem Aufzugssystem (20), wenn eine von einer Aufzugsteuerung (40) getrennte Sicherheitssteuerung (52) die Bewegung der Aufzugskabine (22) verhindert, da die einzelnen Statusinformationen von einem einer Vielzahl von Sicherheitskontakten, die von der Sicherheitssteuerung (52) empfangen werden, einen unsicheren Zustand des Aufzugssystems (20) anzeigen, wobei die Aufzugsteuerung (40) den Betrieb der Aufzugskabine (20) steuert; das Verfahren umfasst:
    die Sicherheitssteuerung (52) stellt eine Verbindung mit einer entfernten Rechenvorrichtung her;
    die entfernte Rechenvorrichtung (64) sendet erste Authentifizierungsinformationen (500) an die Sicherheitssteuerung (52);
    die Sicherheitssteuerung (52) prüft, ob die ersten Authentifizierungsinformationen (500) eine Authentifizierungsbedingung erfüllen; und
    wenn die ersten Authentifizierungsinformationen (500) die Authentifizierungsbedingung erfüllen, Authentifizieren der entfernten Rechenvorrichtung (64); und
    wenn die entfernte Rechenvorrichtung (64) authentifiziert ist, der entfernten Rechenvorrichtung (64) zu gestatten, die Sicherheitssteuerung (52) zu umgehen, um die Bewegung der Aufzugskabine (22) zu ermöglichen.
  11. Verfahren nach Anspruch 10, ferner umfassend:
    die entfernte Rechenvorrichtung (64) sendet einen Umgehungsbefehl an die Sicherheitssteuerung (52); und
    wobei die Sicherheitssteuerung (52) den Umgehungsbefehl empfängt, bevor sie die Bewegung der Aufzugskabine (22) freigibt.
  12. Verfahren nach Anspruch 10 oder 11, ferner umfassend:
    die entfernte Rechenvorrichtung (64) sendet zweite Authentifizierungsinformationen (600) an die Aufzugsteuerung (40);
    die Aufzugsteuerung (40) prüft, ob die zweiten Authentifizierungsinformationen (600) eine Authentifizierungsbedingung erfüllen; und
    wenn die zweiten Authentifizierungsinformationen die Authentifizierungsbedingung erfüllen, Authentifizieren der entfernten Rechenvorrichtung (64).
  13. Verfahren nach Anspruch 11 oder 12, das weiterhin Folgendes umfasst: die entfernte Rechenvorrichtung (64) sendet einen Aktionsbefehl an die Aufzugsteuerung (40); und
    die Aufzugsteuerung (40) steuert den Betrieb der Aufzugskabine (22), um als Reaktion auf den Aktionsbefehl nach der Authentifizierung eine Aktion auszuführen.
  14. Verfahren nach einem der Ansprüche 10 bis 13, ferner umfassend: die entfernte Rechenvorrichtung (64) verschlüsselt die ersten Authentifizierungsinformationen (500) unter Verwendung eines öffentlichen Schlüssels (502) und die Sicherheitssteuerung (52) entschlüsselt die ersten Authentifizierungsinformationen (500) unter Verwendung eines privaten Schlüssels (504), der in der Sicherheitssteuerung (52) gespeichert ist.
  15. Verfahren nach einem der Ansprüche 10 bis 14, das ferner umfasst: das Senden der ersten Authentifizierungsinformationen (500) durch das entfernte Computergerät (52) an die Sicherheitssteuerung (52) über ein drahtloses Netzwerk.
EP21176745.4A 2021-05-28 2021-05-28 Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine Active EP4095079B1 (de)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP21176745.4A EP4095079B1 (de) 2021-05-28 2021-05-28 Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine
US17/529,563 US20220380173A1 (en) 2021-05-28 2021-11-18 Elevator system and method for restoring operation of an elevator car
CN202111367923.7A CN115402902B (zh) 2021-05-28 2021-11-18 用于恢复电梯轿厢的操作的方法和电梯系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP21176745.4A EP4095079B1 (de) 2021-05-28 2021-05-28 Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine

Publications (2)

Publication Number Publication Date
EP4095079A1 EP4095079A1 (de) 2022-11-30
EP4095079B1 true EP4095079B1 (de) 2025-11-12

Family

ID=76197269

Family Applications (1)

Application Number Title Priority Date Filing Date
EP21176745.4A Active EP4095079B1 (de) 2021-05-28 2021-05-28 Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine

Country Status (3)

Country Link
US (1) US20220380173A1 (de)
EP (1) EP4095079B1 (de)
CN (1) CN115402902B (de)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4177206B1 (de) * 2021-11-05 2025-06-11 Otis Elevator Company Einklemmungsvermeidung in einem aufzugssystem
EP4389665B1 (de) * 2022-12-22 2025-07-02 Otis Elevator Company Überprüfung von konfigurationsparameteränderungen in einem aufzugssicherheitssystem
EP4406895A1 (de) * 2023-01-30 2024-07-31 Otis Elevator Company Aufzugssystem und verfahren zur authentifizierung einer berechnungsvorrichtung für eine sicherheitssteuerung eines aufzugssystems
EP4474330B1 (de) * 2023-06-05 2025-11-26 KONE Corporation Aufzug und verfahren zur demonstration des betriebs eines aufzugssicherheitssystems
US11964848B1 (en) * 2023-06-12 2024-04-23 Otis Elevator Company Elevator pit monitoring and integrity check of monitoring system
US11999591B1 (en) * 2023-06-12 2024-06-04 Otis Elevator Company Elevator system including sensor assembly for person detection

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005113400A1 (ja) * 2004-05-21 2005-12-01 Mitsubishi Denki Kabushiki Kaisha 昇降機の遠隔監視制御システム
JP5550302B2 (ja) * 2009-10-19 2014-07-16 東芝エレベータ株式会社 エレベータの救出運転システム
JP6207961B2 (ja) * 2013-10-11 2017-10-04 株式会社日立製作所 エレベータの安全システム
CN107848743B (zh) * 2015-07-15 2019-07-09 奥的斯电梯公司 电梯控制系统
CN109896380A (zh) * 2017-12-11 2019-06-18 日立楼宇技术（广州）有限公司 一种远程救援的电梯系统以及救援方法
EP3511280B1 (de) * 2018-01-11 2022-08-24 Otis Elevator Company Rettungsmassnahme in einem aufzugssystem
US11072515B2 (en) * 2018-03-27 2021-07-27 Otis Elevator Company Automated elevator maintenance mode initiation
CN108996349B (zh) * 2018-07-31 2019-11-26 上海新时达电气股份有限公司 可触摸交互的电梯求助装置、系统及方法
FI3835247T3 (fi) * 2019-12-10 2026-01-30 Kone Corp Hissin etäkäyttö
EP3835248B1 (de) * 2019-12-10 2025-10-29 KONE Corporation Fernbetrieb eines aufzugs
EP3848317A1 (de) * 2020-01-09 2021-07-14 KONE Corporation Aufzugsicherheitssystem
CN111559682B (zh) * 2020-05-27 2021-06-04 江苏省特种设备安全监督检验研究院 一种特定情况下电梯困人远程救援系统及其方法与电梯

Also Published As

Publication number Publication date
CN115402902B (zh) 2025-03-07
EP4095079A1 (de) 2022-11-30
CN115402902A (zh) 2022-11-29
US20220380173A1 (en) 2022-12-01

Similar Documents

Publication Publication Date Title
EP4095079B1 (de) Aufzugssystem und verfahren zur wiederherstellung des betriebs einer aufzugskabine
CN110027959B (zh) 在电梯系统中的解救操作
CN107848743B (zh) 电梯控制系统
CN105473481B (zh) 用于使目的地录入系统与建筑物安全对接的系统和方法
AU2018356262C1 (en) Safety system for a building-related passenger transportation system
CN110182661B (zh) 用于电梯系统的安全电路、更新这种安全电路的装置和方法
JP7348886B2 (ja) エレベーター管理システム及びエレベーター運行管理システム
CN106006240B (zh) 电梯系统及无线通信方法
US20180314512A1 (en) Software updating device
US20240253946A1 (en) Elevator system and method of authenticating a computing device to a safety controller of an elevator system
CN113614016B (zh) 用于结合于建筑物的人员运送设施的安全装置
CN113508087B (zh) 电梯系统
CN119156338A (zh) 用于操作电梯以进行维护的方法
JP7666408B2 (ja) 工場作業場における作業者の安全管理システム及び安全管理方法
WO2025172200A1 (en) Method and controller of an elevator configured for establishing a secure data communication with a mobile device
HK40053329B (en) Security device for building-related passenger conveyor system
CN116767992A (zh) 一种物料提升机的安全监控方法及装置
TW202517563A (zh) 電梯之控制系統、電梯之控制方法及電梯
JP2023174028A (ja) 工場作業場における作業者の安全管理システム及び安全管理方法
HK40053329A (en) Security device for building-related passenger conveyor system
CN117819320A (zh) 施工升降机的运行权限的控制系统、方法以及施工升降机
CN121425922A (zh) 一种电梯控制系统及电梯的控制方法
HK40047858A (en) Remote operation of an elevator

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20230526

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20250801

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: CH

Ref legal event code: F10

Free format text: ST27 STATUS EVENT CODE: U-0-0-F10-F00 (AS PROVIDED BY THE NATIONAL OFFICE)

Effective date: 20251112

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602021042121

Country of ref document: DE